Commit 0ab1cabc authored by Karamel's avatar Karamel
Browse files

Add 'allowed_origin' in config and CORS headers in api

parent a71dbd1e
......@@ -53,6 +53,24 @@ if (isset($_GET[PT::URL_ACTION_PARAM])) {
$broker = new APIBroker($api);
$result = $broker->run($action, $params);
if (array_key_exists('allowed_origin', getConfig()) && array_key_exists('HTTP_ORIGIN', $_SERVER)) {
// Handle CORS
$config = getConfig();
$cors = $config['allowed_origin'];
$origin = $_SERVER['HTTP_ORIGIN'];
// Accept *, single value match or in array
$allowedOrigin = ($cors === '*'
|| (!is_array($cors) && $cors === $origin)
|| (is_array($cors) && in_array($origin, $cors)));
if ($allowedOrigin) {
header('Access-Control-Allow-Origin: ' . $origin);
header('Access-Control-Allow-Credentials: false'); // Turned off for now, api should embed token in requests.
header('Access-Control-Max-Age: ' . $config['jwt_timeout']);
if (is_array($cors)) { header('Vary: Origin'); }
} else {
Log::info('Call from ' . $origin . ' probably rejected (CORS)');
}
}
if ($api == 'ImagesAPI') {
// Special case of images api with binary data
header('Cache-Control: max-age=864000');
......
......@@ -52,6 +52,11 @@ $config['thumb_quality'] = 50;
$config['jwt_timeout'] = 600; // Validity in seconds of an auth token
$config['jwt_secret'] = 'Change this to a superstrong password';
// Allow CORS for ajax clients from other domains.
// Can be a single value like '*' (not recommended)
// or an array of hosts with protocol.
// If disabled, accepts only requests from the same domain
//$config['allowed_origin'] = ['https://my.client.com', 'https://other.domain.com'];
// Paypal config (for module payment)
$config['pp_sandbox_id'] = '';
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment